Vulnerabilities CVE-2026-9087

CVE-2026-9087

Medium

Open

TLP:CLEAR

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

Details

CVSS Score: 6.4
EPSS Score ⓘ: 0.31%

23.7th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Confidence: 90%
Published: May 20, 2026
Last Modified: Aug 3, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.